When an organization submits a security standard waiver request, what compensatory measures should be taken until fix actions occur?

When an organization submits a security standard waiver request, what compensatory measures should be taken until fix actions occur?

• A. Extra security patrols, new procedures, barricades, or additional locks
• B. Increased audits
• C. Public notices
• D. Staff rotations

Answer: (A)

Compensatory measures are temporary controls that maintain an equivalent level of protection while the organization completes the required fixes for a security standard waiver. In this situation, the goal is to keep risk from increasing by adding practical layers you can implement quickly. Extra security patrols deter and detect unauthorized activity and provide immediate coverage; new procedures establish consistent, safer practices to reduce the chance of a breach; barricades physically deter access; additional locks strengthen who can enter controlled areas. Together, these directly address the vulnerability and can be scaled back once the fix actions are in place. Other options don’t address the immediate risk in the same way. Increased audits focus on oversight rather than reducing the chance of an incident; public notices can expose information or cause unnecessary concern; staff rotations may not affect the specific vulnerability and can disrupt operations.

Compensatory measures are temporary controls that maintain an equivalent level of protection while the organization completes the required fixes for a security standard waiver. In this situation, the goal is to keep risk from increasing by adding practical layers you can implement quickly. Extra security patrols deter and detect unauthorized activity and provide immediate coverage; new procedures establish consistent, safer practices to reduce the chance of a breach; barricades physically deter access; additional locks strengthen who can enter controlled areas. Together, these directly address the vulnerability and can be scaled back once the fix actions are in place.

Other options don’t address the immediate risk in the same way. Increased audits focus on oversight rather than reducing the chance of an incident; public notices can expose information or cause unnecessary concern; staff rotations may not affect the specific vulnerability and can disrupt operations.